Alex Rousskov [Thu, 24 Nov 2011 07:20:46 +0000 (00:20 -0700)]
Avoid crashes when processing bad X509 common names (CN).
X509_REQ_get_pubkey() returns a refcounted object that we must clean after use.
X509_REQ_get_subject_name() does not; cleaning the result may cause segfaults.
How we are supposed to tell the difference is beyond me.
Amos Jeffries [Tue, 11 Oct 2011 02:12:56 +0000 (20:12 -0600)]
Add directive dns_v4_first to make IPv4 connections before IPv6 is tried.
Default off, to prefer the faster protocol.
The use-case for this is networks which are IPv6-enabled but stuck
behind slow tunnels and whose upstream is not supporting full transit
services over IP.
Bug 3190: Large HTTP POST stuck after early ICAP 400 error response
When an ICAP REQMOD service responds with an error to
(or the REQMOD transaction aborts while processing) a large HTTP
request, the HTTP request may get stuck because the request body
buffer gets full and nobody consumes the no-longer-needed content.
The ICAP code quits but leaves the body buffer intact in case the
client-side code wants to bypass the error. After that, nobody consumes
the request body because the buggy client side does not inform the body
pipe that there will be no other consumers, which would have triggered
a noteBodyConsumerAborted() callback and enable auto-consumption or closed
the client connection.
Amos Jeffries [Sun, 28 Aug 2011 06:14:58 +0000 (00:14 -0600)]
Remove hierarchy_stoplist default value
This should have been done long ago with the other dynamic website
handling changes. It has caused a certain amount of confusion when things
which apparently should go to peers fail to reach them.
Alex Rousskov [Sat, 27 Aug 2011 12:34:04 +0000 (06:34 -0600)]
Polished unused code.
The unused dlopen() call is actually useful to enable when lt_dlopen() reports
"file not found" errors for loadable modules that do exist but that Libtool
cannot load successfully due to undefined symbols or other errors.
This inability to correctly report a library loading error is a long-standing
Libtool bug, stemming from Libtool's desire to try and load several
differently named library files until one succeeds, losing true error
information in the process.
Amos Jeffries [Sat, 27 Aug 2011 07:45:03 +0000 (01:45 -0600)]
Fix NIS helper build on FreeBSD
Fails on clang++ and other strict compilers due to missing __cplusplus
checks in FreeBSD system headers and yp_prot.h typedefs bool unless
BOOL_DEFINED is defined.
Alex Rousskov [Sat, 27 Aug 2011 07:14:24 +0000 (01:14 -0600)]
Bug 3217: "!fd_table[fd].closing()" from ServerStateData::noteMoreBodySpaceAvailable
It is possible that the next hop connection is going through the closing steps
when we receive a "noteMoreBodySpaceAvailable" notification from the response
body consumer. Do not try to read in this case.
Bertrand Jacquin [Sat, 27 Aug 2011 06:48:42 +0000 (00:48 -0600)]
Bug 2662: cf_gen failure when cross compiling
Adds support for "./configure HOSTCXX=foo" to specify a host compiler
to build cf_gen with. If none is specified the normal build compiler will
be used.
Regression fix: vhost and defaultsite causing vport to be ignored
Instead of dropping it completely we should be sanely combining them like
Squid-2 does for most cases. This appears to have been lost while removing
the getmyHostname() from the process and reducing the
prepareTransparentUrl code.
This fix makes vport apply even if vhost was used. It will modify the
Host: header contents according to the documented vport semantics.
This fix makes vport apply even if defaultsite= was used. It will append
the specified port to the domain name given. Domains with port attached
are not supported and will produce invalid URLs.
TODO: detect this case while parsing the initial config and warn.
Regression fix: vhost and defaultsite causing vport to be ignored
Instead of dropping it completely we should be sanely combining them like
Squid-2 does for most cases. This appears to have been lost while removing
the getmyHostname() from the process and reducing the
prepareTransparentUrl code.
This fix makes vport apply even if vhost was used. It will modify the
Host: header contents according to the documented vport semantics.
This fix makes vport apply even if defaultsite= was used. It will append
the specified port to the domain name given. Domains with port attached
are not supported and will produce invalid URLs.
TODO: detect this case while parsing the initial config and warn.
Enable negative cacheing on unknown or -1 expiry timestamp
This syncs the squid-3 code with what squid-2 does. There seem to be no
problems in squid-2, but squid-3 does not cache at times when it should
according to negative_ttl
Bug 2051: 'default' cache_peer option does not match documentation
Move the default parent to second-lowest priority on the parent
selection. This also allows the other more delicate balancing
algorithms to work properly with a default configured.
sourcehash and userhash are reversed in priority to simplify and
speed the selection code.
Also, getAnyParent() is dropped. It is redundant with the FIRSTUP
algorithm.
Amos Jeffries [Fri, 17 Jun 2011 13:26:58 +0000 (07:26 -0600)]
Fix squidclient -V option and allow non-HTTP protocols to be tested
The "-" case is for old style HTTP (called 0.9) where there is no version
string. The "-V 0.9" is for testing servers with broken version number
tag "HTTP/0.9". Do not mix these up!
This also adds the ability to send non-HTTP version tags for testing.
ie "-V ICAP/1.0" or "-V ICY/1.0"
Fixed bypass of SSL certificate validation errors.
The bypass code was calling ACLChecklist::fastCheck() multiple times
if multiple certificate errors were found. That method should not be
called multiple times because it changes the internal ACLChecklist
state, producing wrong answers for repeated calls.
This patch fixes the ACLChecklist::fastCheck() method so it can be called
multiple times. Each fastCheck() call results in an independent access
list check.
Alex Rousskov [Fri, 17 Jun 2011 13:21:15 +0000 (07:21 -0600)]
Bug 3153: Prevent ICAP RESPMOD transactions getting stuck with the adapted body.
Part 1.
Server is expected to receive adapted response headers and then consume the
adapted response body, if any. If the server receives the headers and then
aborts, it must notify the ICAP side that nobody will consume the body.
Otherwise, the ICAP transaction will fill the BodyPipe buffer and get stuck
waiting for the consumer to free some space.
Part 2:
This fix still leaves one potential race condition unhandled: The ICAP
Initiatee disappears right after sending the adapted headers to the Server
(because there is nothing else for that initiatee to do). After the
noteAdaptationAnswer() call is scheduled by ICAP and before it is received by
the Server job, there is no usable link between Server and ICAP. There is no
way for the Server to notify the ICAP transaction that the Server job is
aborting during that time (and there is no Server job at all after it aborts,
naturally).
The solutions is to develop a custom AsyncCall which will call the
expectNoConsumption() on the message pipe if the call cannot be dialed (i.e.,
the message cannot be delivered to Server).
Bug 3214: "helperHandleRead: unexpected read from ssl_crtd" errors.
Squid would read the beginning of a crtd response split across multiple
read operations and treat it as a complete response, causing various
certificate-related errors.
This patch:
- allow the use of other than the '\n' character as the end of message mark
for helper responses.
- Use the '\1' char as end-of-message char for crtd helper. This char looks
safe because the crtd messages are clear text only messages.
projects / thirdparty / squid.git / log
